Vantage Report 3.1 Support Notes

Transcription

1 Vantage Report 3.1 Support Notes Jul 2007

2 Vantage Report Support Notes Application Notes Server Configuration VRPT Registration & Activation with MyZyXEL.com License Migration when Re-installing VRPT Time Setting & Log Time How to enable customized Web Server port on VRPT How to configure Mail Server on VRPT How to set Stored Log Days on VRPT How to migrate data from VRPT 3.0 to VRPT How to use privilege view report Adding device to Device Tree of VRPT Dashboard for quick view of network Viewing Logs Viewing Log Receiver report Viewing all logs under Log Viewer Monitor function for live check Bandwidth and Service monitor UTM (Attack/Intrusion/AntiVirus/AntiSpam) monitor Viewing Traffic Report Log settings on device Direction for Bandwidth Usage Viewing Bandwidth Usage Using Customized Service to Determine Illegal Usage Viewing VPN Report Log settings on devices VPN Set-to-Set application (for ZyNOS/ZLD devices) VPN Remote Access application (IPsec) (for ZLD devices) VPN Remote Access application (SSL) (for ZLD devices) Viewing UTM Report Log settings on devices Suggested countermeasure for UTM Report Viewing Security Report Log settings on devices Viewing Firewall Access Control Report Viewing Application Access Control Report (for ZLD devices) Viewing User Aware Report (for ZLD devices) Log settings on devices User Aware Application on Traffic Report User Aware Application on Login Record How to use Schedule Report How to configure schedule report...68 All contents copyright (c) 2007 ZyXEL Communications Corporation. 2

3 1.9.2 How to set schedule report template How to use DNS Reverse & Hostname Reverse The way to use DNS Reverse function The way to use Hostname Reverse function Product FAQ System Related FAQ...74 Q1: What is Vantage Report (VRPT)?...74 Q2: Which operating systems are supported by VRPT 3.1 Server?...75 Q3: What kinds of reports are supported by VRPT?...75 Q4: Which components are included by VRPT 3.1?...75 Q5: How to install VRPT 3.1 server on the PC?...75 Q6: How to access VRPT 3.1?...75 Q7: How long will raw data (device logs) be summarized in VRPT database?...76 Q8: What can I do if I forget the password when logging in VRPT?...76 Q9: Known Issue for Web Browser Supported by VRPT Q10: VRPT will be installed as a Window Service by default, is it right?...77 Q11: Report Pattern for Schedule Reports Q12: Related General Public License about VRPT Q13: The meaning of AC related Registration and Activation with myzyxel.com Device Related FAQ...77 Q1: Which types of devices are supported by VRPT 3.1?...77 Q2: How many devices are supported by VRPT 3.1?...78 Q3: How to check traffic logs report on VRPT 3.1 for ZyXEL xdsl products?...78 Q4: How can I monitor VPN bandwidth or VPN Usage for ZyXEL xdsl products?...78 Q5: How can I check the Anti-Virus status for ZyXEL xdsl products on VRPT 3.1?...78 Q6: How can I check Intrusion/AntiVirus/AntiSpam report for ZyWALL series with f/w 3.63, 3.64 or 3.65?...78 Q7: What s the brief data flow for VRPT server to generate report? Trouble Shooting Server Related Trouble Shooting What to check if you can not access the GUI of VRPT Server? Why can t I start up VRPT 3.1 after installing it? Why does VRPT 3.1 shutdown automatically without any reason? Why does my Web page come back to Login page? Is there any way to check if VRPT server has received Syslogs from device? Why VRPT 3.1 can not get any log even when I correctly add device in it? Device Related Trouble Shooting What could be wrong with Security Policy stay empty also with web action? Why are there no new logs received by VRPT 3.1?...81 All contents copyright (c) 2007 ZyXEL Communications Corporation. 3

4 1 Application Notes 1.1 Server Configuration VRPT Registration & Activation with MyZyXEL.com Below is a brief flow that describes the evolvement from Basic version to Full version. When user installs VRPT 3.1, VRPT will show as Basic version. There re two ways to upgrade Basic version to Full version. One is to achieve it by trial activation. But this kind of Full version has time restriction (30 days). Also in this Trial version, user only can manage one node (device). The other is to upgrade to Full version by inputting legal license user ever bought. There are other two kinds of license. One kind supports 5 nodes, that user could manage 5 devices at most if he/she buy it. The other kind supports 25 nodes. Please notice the most devices that VRPT 3.1 can managed is 100. VRPT Service Activation- Install Upgrade to Trial Version All contents copyright (c) 2007 ZyXEL Communications Corporation. 4

5 1. Go to System>Registration, then click Trial. 2. Input User Name, Password, Address and Country. 3. VRPT 3.1 will send the User Name, Password, Trial License key and other information to myzyxel.com. All contents copyright (c) 2007 ZyXEL Communications Corporation. 5

6 VRPT Service Activation-Install to Full Version If user has already installed VRPT service and wants to skip trial version to extend management node directly, he/she could follow such steps to do so. 1. Go to System>Registration 2. Input User Name, Password, License Key and other information. All contents copyright (c) 2007 ZyXEL Communications Corporation. 6

7 3. VRPT will send such items and other information to myzyxel.com and complete authentication. VRPT Service Activation-Trial version Upgrade to Full version If user has already activated VRPT trial service and wants to upgrade to Full status, please just follow such steps. 1. Click Upgrade button. 2. Input License. All contents copyright (c) 2007 ZyXEL Communications Corporation. 7

8 3. VRPT will send License Key and other information to myzyxel.com and complete authentication. NOTE: If user reinstalls VRPT at same machine with OS untouched and it was full version already, VRPT will remain as full status. VRPT Service Extend Basic to Full version If user has installed VRPT service and VRPT is already in full status, user could extend management node by purchasing more license key and do upgrade for extension. 1. Go to System>Registration and press Upgrade. 2. Input License Key All contents copyright (c) 2007 ZyXEL Communications Corporation. 8

9 3. VRPT will send License Key and other information to myzyxel.com for authentication. And after such operation, the allowed nodes will increase to the legal number. One license key supports 5 nodes at most License Migration when Re-installing VRPT 3.1 Due to some reason that customer only needs to re-install VRPT on the same machine and remains other environment untouched, it is only needed to go to System>Registration to press Refresh button to migrate license after finishing installing VRPT. While if customer wants to run VRPT on a more powerful machine (OS upgrade or OS re-install on the same machine is also included) and still wants to keep previous license, he should go to myzyxel.com to complete registration. 1. Please choose registered VRPT and press Reinstall. 2. New Authentication Code is needed in this step. User could obtain it when installing VRPT trial version on new PC. Please go to System>Registration to get it. All contents copyright (c) 2007 ZyXEL Communications Corporation. 9

10 3. Press Continue, myzyxel.com will fresh product Information to new one. 4. After finishing reinstall on registration site, access VRPT on the new PC to enter registration page. Click Refresh button. You will see the license page. All contents copyright (c) 2007 ZyXEL Communications Corporation. 10

11 1.1.3 Time Setting & Log Time When VRPT 3.1 receives logs, it will replace the time of the logs as VRPT Server s current time. So it is normal for different devices that each has individual system time sending logs with universal time on VRPT How to enable customized Web Server port on VRPT 3.1 User could change the default TCP port 8080 to customized one when installing VRPT. Please do such change in Configuration step. All contents copyright (c) 2007 ZyXEL Communications Corporation. 11

12 After finishes installation, you can still change the customized server port under System>Server Configuration How to configure Mail Server on VRPT 3.1 All contents copyright (c) 2007 ZyXEL Communications Corporation. 12

13 Please input your SMTP mail server s IP address or domain name in the blank SMTP IP Address or Domain Name. Make sure your username and password are correct and the Sender s mail address is correspondent to the account you specified in the User Name and Password columns. After that, please click the Apply button. We can also test if the mail settings are correct by clicking Test button after the settings are applied. We will receive an from the VRPT server as the following: All contents copyright (c) 2007 ZyXEL Communications Corporation. 13

14 1.1.6 How to set Stored Log Days on VRPT 3.1 Please go to System>General configuration, and specify the stored log days in the following column How to migrate data from VRPT 3.0 to VRPT 3.1 As we know it is a little bit fussy for user to add device to VRPT especially when the amount of device is not small. You should go to input MAC address of LAN one by one, choose device type etc. Now if you want VRPT 3.1 to manage the devices that are in the charge of VRPT 3.0, the job will be done well and fast by following steps and you can also check Upgrade Note. NOTE: 1. We can upgrade to VRPT3.1 directly from VRPT3.0, or VRPT or VRPT The upgrade package doesn t backup the data in database. In case of failure upgrade, in order not to lose all the data, please backup the content in the folder Vantage Report\mysql\data, or just go to the web page to backup the configuration file and device list as the following: After you login VRPT 3.0, go to System>Data Maintenance>Configuration Backup & Restore page, click Backup button to backup the system configuration. All contents copyright (c) 2007 ZyXEL Communications Corporation. 14

15 Go to System>Data Maintenance>Device List Import & Export page, click Export button to export the device list. Once the upgrade fails, you can restore the configuration and device list How to use privilege view report From version 3.1, VRPT begins to provide user different privileges for view the reports. We can create different groups with some specific devices in each group, and assign different user accounts in different groups. With an account in a specific group, the user can only view the reports for the specific devices in this group. There s a default group with the name of super, and a default account with username and password root, root in this group. Users in this group can view all the devices registered to the VRPT server. Here re the steps to create user accounts with different view privileges. Note: We can only create new groups and user accounts with accounts in the super group. 1. Go to System > User Management > Group; click Add to add a new group. 2. Give a descriptive name to this group, some notes in the Description section is optional, and check the devices that you want to assign to this group, then click Apply. All contents copyright (c) 2007 ZyXEL Communications Corporation. 15

16 3. Go to System > User Management > Account, click Add to add a new account. 4. Enter User Name, Password, mail address, and choose a group from the dropdown list. Then click Apply. All contents copyright (c) 2007 ZyXEL Communications Corporation. 16

17 The new account in a new group is created, when login with this account, only the specific devices in this group can be viewed. All contents copyright (c) 2007 ZyXEL Communications Corporation. 17

18 As we know we can upgrade to VRPT3.1 directly from VRPT3.0, VRPT or VRPT 3.0.2, and these VRPT versions didn t support Group. So if your VRPT Server upgraded from these versions, after upgrade successfully, go to System>User Management>Group, you ll notice there exists two groups super and normal. When clicking the hyperlink on normal, you will see all devices are selected in normal group. All contents copyright (c) 2007 ZyXEL Communications Corporation. 18

19 Go to System>User Management>Account, all user accounts except root in old VRPT version will belong to normal group, root belongs to super group Adding device to Device Tree of VRPT VRPT 3.1 supports multiple devices. Logs from these devices will be analyzed and imported to VRPT database. And then user could query reports for every individual device. But first of all, the device should be added to Device Tree which is on the left Device window of VRPT. The picture below shows VRPT interface layout. All contents copyright (c) 2007 ZyXEL Communications Corporation. 19

20 You should move cursor to root folder then right click. After the Add Device windows appears, correct Name, MAC address and Type are needed if user wants to add a device for management. NOTE: If the device doesn t exist in this dev tree, its log will be discarded by VRPT. And also please make sure the MAC address is LAN MAC address of the device. If user once removes a device from Device Tree, all the historical info about it will be removed by VRPT. And the process will take a period of time. All contents copyright (c) 2007 ZyXEL Communications Corporation. 20

21 Dashboard for quick view of network MIS engineer always begins his work like this: take about 10 minutes to take a quick view of network healthy. At this moment, not all the reports are necessary to pop out to windows. Maybe the VPN usage is the first concern for ZyWALL 1050 and Attack report is most important for another ZyWALL device because attack is very heavy these days. So most important reports accompanying with most important devices (network) are taken into consideration. Dashboard report gives a platform to achieve this goal. 1. To set the profile for dashboard 2. You can view the dash board every time when you enter Dashboard menu and also you can change the profile by clicking the icon on the right top. All contents copyright (c) 2007 ZyXEL Communications Corporation. 21

22 NOTE: Only the VRPT administrator in the super group has the right to establish and change dashboard profiles. 1.2 Viewing Logs Viewing Log Receiver report There s a lot of work for MIS everyday. Total PC maintenance job, company web site system maintenance, internal DB maintenance But boss still want me to give out the overall statistics about the network condition in short form every day or over a period of time. What can I do? Hey, Log Receiver can pull you out of heavy work. All contents copyright (c) 2007 ZyXEL Communications Corporation. 22

23 1. By Day report Log Receiver by days under System>Log Receiver shows concise statistics of network condition everyday. It is a good tool to look through network before going to every detailed report. This picture illustrates the condition before a MIS has the Log Receiver report. This picture illustrates the MIS engineer that has the log receiver report. All contents copyright (c) 2007 ZyXEL Communications Corporation. 23

24 2. By Device report Also Log Receiver speeds up the process to diagnose the network. Always the number of logs directly reflects the network condition belongs to the specific device. By Device report help us to locate the problematical network quickly. Then user can trace the root cause by looking into specific report and take action on ZyWALL devices Viewing all logs under Log Viewer Log Viewer>All Logs will show all the logs accepted by VRPT. It will need VRPT about 5 minutes to load these heavy data. Here 5 minutes means the interval between VRPT receives and shows such logs under Log Viewer>All Logs. 1.3 Monitor function for live check VRPT gives live monitor report according to the logs received during the last 60 minutes Bandwidth and Service monitor Live monitor report for Bandwidth and Service will be shown as continuous curves for they are generated by traffic logs. The x axes of each report shows the lease time. The unit for it is minute. Please see the following sample report about the Bandwidth Monitor report, and the illustration about the report. All contents copyright (c) 2007 ZyXEL Communications Corporation. 24

25 Bandwidth /Service Monitor Repor Coordinate Meaning Unit Xaxis Lease time Minute Yaxis speed Kbytes/s UTM (Attack/Intrusion/AntiVirus/AntiSpam) monitor Live report for Attack, Intrusion, AntiVirus and AntiSpam will expose to you as discrete picture for it monitors event logs. Please see the following sample report about the Bandwidth Monitor report, and the illustration about the report. Attack/Intrusion/AntiVirus/AntiSpam Monitor Report Coordinate Meaning Unit Xaxis Lease time Minute Yaxis Number of the events 1.4 Viewing Traffic Report Traffic Report gives administrator the convenience to check the bandwidth usage on the registered devices. Traffic Report is generated by the traffic logs sent from the All contents copyright (c) 2007 ZyXEL Communications Corporation. 25

26 device. To view the Traffic Report, we should enable sending traffic logs on the devices Log settings on device Log settings on ZyNOS devices Note that traffic log is only available for ZyWALL 5/35/70 with firmware 3.63 and later, and is not available on ZyXEL xdsl devices. 1. Enable Traffic Log from GUI (ewc) First please enable syslog logging on the ZyNOS device. Please go to Logs>Log Settings, and input the server name or the IP address of VRPT server. Then go to Reports>System Reports, check Send Raw Traffic Statistics to Syslog Server for Analysis. 2. Enable Traffic Logs from SMT (Telnet/Console) menu Enter its SMT Menu24.8 and type: RAS>sys log load RAS> sys log cat traffic 1 All contents copyright (c) 2007 ZyXEL Communications Corporation. 26

27 RAS> sys log save Log settings on ZLD devices First please enable syslog logging on the ZLD device. Please go to Maintenance>Logs>Log Setting>Remote Server>Edit to active log for VRPT server. Make sure the Server Address before VRPT server collects logs. Then please go to ZyWALL 1050>Maintenance>Logs>Log Setting>Remote Server>Edit to Enable the traffic log. All contents copyright (c) 2007 ZyXEL Communications Corporation. 27

28 1.4.2 Direction for Bandwidth Usage User could choose different direction for their Bandwidth usage report. The meaning of the previous ten directions is as their names. INBOUND, includes LAN-to-WAN-receive, DMZ-to-WAN-receive, WAN-to-WANreceive, WAN-to-LAN-send, WAN-to-DMZ-send OUTBOUND includes LAN-to-WAN-send, DMZ-to-WAN-send, WAN-to-WAN-send, WAN-to-LAN-receive, WAN-to-DMZ-receive NOTE: The direction is very useful for administrator to add firewall or other rules to control the network condition for a single IP address is not enough. Also, user could choose directions for Bandwidth report in scheduled report Viewing Bandwidth Usage One day the employees complain the network of the company is so bad that they even can not send and receive the properly. All the traffic go through a ZyWALL 70.The administrator will go to this device and check the Traffic>Bandwidth>Top Hosts. He finds the following report. All contents copyright (c) 2007 ZyXEL Communications Corporation. 28

29 It shows the users with IP address is on the top of the list. Administrator could enter the drill down menu of it to check further. See the picture below. All contents copyright (c) 2007 ZyXEL Communications Corporation. 29

30 Protocol type others assumes large amount of events and bandwidth. From all the symptoms administrator could infer that this user is downloading large files and the protocol is not in the standard list of device. This kind of operation affects other user s normal usage. Administrator locates the error host according to the direction of the Bandwidth and he may find the definite root cause by setting customized service. Administrator can add firewall rule with its direction according to the Bandwidth direction to control the network condition. Also, administrator could go to Traffic>Bandwidth>Top Protocols report for help Using Customized Service to Determine Illegal Usage Here comes a scenario: administrator could determine the problematical host while he still can not find the root cause because the protocol type shows as others. Currently he can find the relation between top protocol and host and then trace the destination IP address. Always this IP address will give you some clues to find out the customized service. After that he goes to Traffic>Customization>Customization to adds emule as try. 1. Go to select the device type for customization service. 2. Go to create customization service. All contents copyright (c) 2007 ZyXEL Communications Corporation. 30

31 Excited result appears! Users are using emule to download media material. Please see the report from Traffic>Customization>Top Sources. All contents copyright (c) 2007 ZyXEL Communications Corporation. 31

32 1.5 Viewing VPN Report Log settings on devices To have VRPT server receive and process VPN logs, we should first enable the VPN logs in devices Log settings on ZyNOS devices First please enable syslog logging on the ZyNOS device. Then enable the VPN logs. All contents copyright (c) 2007 ZyXEL Communications Corporation. 32

33 Log settings on ZLD devices First please enable syslog logging on the ZLD device. Then enable the VPN logs. All contents copyright (c) 2007 ZyXEL Communications Corporation. 33

34 1.5.2 VPN Set-to-Set application (for ZyNOS/ZLD devices) Let s suppose scenario between HQ and branch office. Companies have geographically distributed operation offices, Branch A, Branch B, Branch C and Branch D. Each branch office (remote site) builds several IPsec VPN All contents copyright (c) 2007 ZyXEL Communications Corporation. 34

35 tunnels for different purpose. One is for EIP and the other is for Domain controller. Different users execute different application by different tunnel. HQ MIS administrator can trace the usage of site to site VPN by VPN report. 1. Administrator can check the link status by Link Status report under VPN>Siteto-Site>Link Status. Green status means tunnel is up and red means tunnel is down. 2. Traffic Monitor report helps the administrator to monitor the total amount of traffic handled by a device s VPN tunnels. 3. Top Protocol report can tell which application consumes most bandwidth. If it illegal application appears, you can use firewall or policy rule to stop the waste of bandwidth. All contents copyright (c) 2007 ZyXEL Communications Corporation. 35

36 4. Also you can check which user or host consumes most bandwidth by Top Users report or Top Hosts report. All contents copyright (c) 2007 ZyXEL Communications Corporation. 36

37 1.5.3 VPN Remote Access application (IPsec) (for ZLD devices) All contents copyright (c) 2007 ZyXEL Communications Corporation. 37

38 Suppose there s VPN mobile user is an employee on the road (a.k.a. teleworker). He wants to gain full network access simply by tapping into an Internet connection. H can build IPSec VPN by remote VPN client, for example ZyWALLP1, to access HQ or branch off internal or remote resource (mail, EIP.). HQ or branch MIS administrator can control the behavior of remote access by Remote Access report. 1. Top User & Traffic can monitor the total number of remote access users connected to the device and the amount of traffic the device handled for the dynamic VPN tunnels. 2. Administrator can check which user is on line by User Status report. All contents copyright (c) 2007 ZyXEL Communications Corporation. 38

39 3. Top Protocol report can tell which application consumes most bandwidth. All contents copyright (c) 2007 ZyXEL Communications Corporation. 39

40 4. Top destination report reflects which server most user access VPN Remote Access application (SSL) (for ZLD devices) All contents copyright (c) 2007 ZyXEL Communications Corporation. 40

41 Suppose some employees are out of the office now, and they don t have any kind of IPsec VPN clients, but they still wants to connect to the company s intra network to fetch some files or visit the company s intra web server through a secured communication, then the SSL VPN is a fine choice. From ZLD 2.0, ZyWALL1050 has added a new feature, which is SSL VPN, and USG 300 also has this feature. SSL VPN provides TLS secured VPN tunnel to transmit data between the remote users and the intra network of ZyWALL1050 (or USG 300). Currently, there re two types of application available on ZyWALL1050 and USG 300, they re Web Application and File Sharing. They can ask the company s MIS to create accounts to the corresponding SSL VPN applications. Then they can simply connect an SSL VPN to the ZyWALL 1050 (or USG 300), and use the corresponding applications from the ZyWALL1050 s (or USG 300 s) portal. The administrator can also give the remote users privilege to build a full tunnel, and the remote users can share the company s intra network, just like a member of the intra network. All contents copyright (c) 2007 ZyXEL Communications Corporation. 41

42 From v3.1, VRPT begins to support SSL VPN report of ZyWALL 1050 and USG 300. It can provide comprehensive reports on the SSL VPN usage on the following respects: User Status Report of protocol usage (Top Protocols) Report about the resorted destinations (Top Destinations) Report of application usage (Top Applications) Report about the SSL VPN traffic from and to different users (Top Users) The company s MIS administrator can control the behavior of remote access by Remote Access (SSL) report. View the reports on VRPT server 1. Administrator can check which user is on line by User Status report. 2. Top Protocols report can tell which application consumes most bandwidth. Administrator can choose user, direction and the reported days from the respective dropdown lists to generate specific reports. All contents copyright (c) 2007 ZyXEL Communications Corporation. 42

43 Click on each protocol s hyperlink, the drill down report for the specific protocol is generated according to top users. NOTE: The drill down report content doesn t inherit from appointed hyperlink. If you choose a specific user from the User dropdown list, then click the hyperlink on one protocol. Drill down report will list all users who use this protocol instead of only the appointed user. All contents copyright (c) 2007 ZyXEL Communications Corporation. 43

44 3. Top destination report reflects which server most user access. Also administrator can choose user, direction and the reported days from the respective dropdown lists to generate specific reports. Also, administrator can click on each destination s hyperlink; the drill down report for the specific destination will be generated according to top users. 4. Top Applications reflects which application was used most. Also administrator can choose user, direction and the reported days from the respective dropdown lists to generate specific reports. All contents copyright (c) 2007 ZyXEL Communications Corporation. 44

45 Also, administrator can click on each application s hyperlink; the drill down report for the specific application will be generated according to top users. 5. Top Users reflects which user consumes most of the bandwidth. Administrator can choose direction and the reported days from the respective dropdown lists to generate specific reports. All contents copyright (c) 2007 ZyXEL Communications Corporation. 45

46 Click on each user s hyperlink, the drill down report for the specific user will be generated. Administrator can choose from the dropdown list to generate the report by protocol, destination, or application for this user. Then administrator can check what kind of protocol he uses most, which destination he resorts most, and what application he uses most. All contents copyright (c) 2007 ZyXEL Communications Corporation. 46

47 1.6 Viewing UTM Report Log settings on devices To have VRPT server receive and process UTM logs, we should enable the IDP, AV, AS logs on the devices Log settings on ZyNOS devices First please enable syslog logging on the ZyNOS device. Then please enable IDP, Anti-Virus, Anti-Spam logs. All contents copyright (c) 2007 ZyXEL Communications Corporation. 47

48 Log settings on ZLD devices First please enable syslog logging on the ZLD device. Then please enable IDP and Anti-Virus logs. All contents copyright (c) 2007 ZyXEL Communications Corporation. 48

49 1.6.2 Suggested countermeasure for UTM Report Intrusion Report VRPT supports intrusion report for IDP 10 and ZyWALL with firmware version 4.0 and above. It provides reports based on Top Intrusion, Top Sources (attacker), Top Destinations (victim) and Severity. These reports are under Network Attack>Intrusion menu. Following is an example to illustrate that an internal host is conducting network treat (e.g. infected by Trojan or DoS) and passing through device. VRPT will obtain the Syslogs from device for analysis. All contents copyright (c) 2007 ZyXEL Communications Corporation. 49

50 1. Configure VRPT Server as the Syslog Server on ZyWALL (with f/w 4.0 or later )or IDP. 2. When ZyWALL or IDP detects intrusion events, it will generate Syslog and forward to VRPT Server. All contents copyright (c) 2007 ZyXEL Communications Corporation. 50

51 3. Through the Report, system administrator can easily find out the intrusion event and the source/destination of the threat of network. And drill-down report of Intrusion report allows user to view the intrusion events by querying Intrusion signatures hit by attacker. In this sample attacker with the IP address is the target for administrator to deal with. Also user could use scheduled report for reminding. All contents copyright (c) 2007 ZyXEL Communications Corporation. 51

52 Here are some hints for administrator to trace the intrusion. Here Top means top ten except Top Severity. The advanced query (Drill down report) can be Top Intrusions/Top Sources/Top Destinations/By Severity. Below are relationships between basic query and advanced query (drill down report). Top Intrusion (Signature) -----Top Host Top Sources Top Signature Top Destinations---Top Signature Top Severity------Top Signature Here Severity includes eight types. The table below shows the types with meanings. Type Emergency: Meaning system is unusable All contents copyright (c) 2007 ZyXEL Communications Corporation. 52

53 Alert Critical Error Warning Notice Informational Debug action must be taken immediately critical conditions error conditions warning conditions normal but significant condition informational messages debug-level messages Administrator should add two firewall rules for the target Source attacker for VRPT do not show the direction of Intrusion (LAN to WAN or WAN to LAN). The attacker may at LAN side or WAN side. For Destination report, administrator should focus its effort on monitor AntiSpam Report AntiSpam report is especially for ZyWALL 5/35/70 UTM AntiSpam feature. Using this kind of report, administrator will trace the sender and source of the Spam Mail. Also user could determine score threshold by checking score report. 1. Administrator could block the senders if the senders are in the Top Senders report or block such spam mails address by adding them into blacklist. All contents copyright (c) 2007 ZyXEL Communications Corporation. 53

54 2. For Top Sources report, administrator could block such IP addresses by adding firewall rules. Please still notice the direction of the rules as that of in the Intrusion scenario. All contents copyright (c) 2007 ZyXEL Communications Corporation. 54

55 3. User could determine score threshold for ZyWALL AntiSpam by By Score report. When AntiSpam function enables, MailShell server will return a score for each passing through ZyWALL. Score report shows return score with its quantity. See below sample. There are 16 s with return score in the 86 to 90 range and 26 s with return score in the 91 to 95 range in the BAR picture. Then administrator could determine reasonable score threshold to control the quantity of the spam mail on ZyWALL. All contents copyright (c) 2007 ZyXEL Communications Corporation. 55

56 AntiVirus Report Under Network Attack>AntiVirus menu, user could find Top Viruses, Top Sources and Top Destinations report. Administrator could monitor top virus types and block such destination and source by firewall rules. ZyWALL 1050 begins to support AntiVirus function from ZLD2.0, and USG 300 also supports AntiVirus. VRPT begins to support AntiVirus reports for ZyWALL1050 and USG 300 from v3.1 correspondently. See below sample. There s a top AV source with the IP address User could find the detailed AV type by checking drill down report. According to the information, user could add firewall rule to block hacker s IP address. But please still notice the firewall rule direction. User should add both LAN to WAN and WAN to LAN directions. All contents copyright (c) 2007 ZyXEL Communications Corporation. 56

57 Also you can monitor the popularity and occurrence about the specify virus by searching Top Virus report. Normally it reflects the trend of virus. 1.7 Viewing Security Report Log settings on devices To have VRPT server receive and process the access control logs, we should first enable the access control logs on the devices Log settings on ZyNOS devices First please enable syslog logging on the ZyNOS device. Then please make sure the Access Control log is enabled. If you also want to log the blocked ICMP packets, please enable the ICMP log. All contents copyright (c) 2007 ZyXEL Communications Corporation. 57

58 For user defined firewall rules, if you want to log the matched packets, please make sure the check box Log Packet Information When Matched is checked in FIREWALL>Rule Summary>Edit Rules. Please see the settings below. All contents copyright (c) 2007 ZyXEL Communications Corporation. 58

59 Log settings on ZLD devices First please enable syslog logging on the ZyNOS device. Then please make sure the Application Patrol and Firewall log are enabled to let the VRPT server generate Firewall Access Control and Application Access Control reports. All contents copyright (c) 2007 ZyXEL Communications Corporation. 59

60 For user defined Firewall rules, please also have the matched packets logged in the web page Configuration>Policy>Firewall>Firewall Rule>Edit. And for Application Patrol rules, if administrator wants to log some kind of matched traffic, please also enable Log function in the web page Configuration>Policy>Application Patrol>Configuration>Edit. All contents copyright (c) 2007 ZyXEL Communications Corporation. 60

61 1.7.2 Viewing Firewall Access Control Report Please go to Security Policy>Firewall Access Control to view the Firewall Access Control report generated by VRPT server. For ZyWALL 1050 and USG series, we can view both Top Users Blocked report and Top Packets Blocked report. For other device models, we can only view Top Packets Blocked report. The following is an example of the Top Users Blocked report. We can choose the report days from the dropdown list to have VRPT server generate corresponding report for the specified days. All contents copyright (c) 2007 ZyXEL Communications Corporation. 61

62 The following is an example of the Top Packets Blocked report. We can choose the report days from the dropdown list to have VRPT server generate corresponding report for the specified days. All contents copyright (c) 2007 ZyXEL Communications Corporation. 62

63 1.7.3 Viewing Application Access Control Report (for ZLD devices) This report is only for ZLD devices currently. Please go to Security Policy>Application Access Control to view this report. VRPT can generate reports according to blocked applications, blocked users, and allowed applications. Please refer to the following examples. 1. Top Applications Blocked. All contents copyright (c) 2007 ZyXEL Communications Corporation. 63

64 2. Top Users Blocked. 3. Top Applications Allowed. All contents copyright (c) 2007 ZyXEL Communications Corporation. 64

65 1.8 Viewing User Aware Report (for ZLD devices) Log settings on devices First please enable syslog logging on the ZyNOS device. That the login records on VRPT server are user aware is consistent with ZyWALL 1050 and USG 300. You can monitor and trace the login history of each user under menu Event>Login only if you have enabled the centralized log on the ZLD devices. All contents copyright (c) 2007 ZyXEL Communications Corporation. 65

66 1.8.2 User Aware Application on Traffic Report User aware is an import conception on the ZLD devices. Vantage Report supports user aware report for administrator to manage the network. Let s take bandwidth report as an example. Under Bandwidth>Top Users, it is easy to look through the bandwidth usage for every user. Also you can just click the bar on the report to get brief information. The sample displays shows the usage report for user1 and user2. All contents copyright (c) 2007 ZyXEL Communications Corporation. 66

67 1.8.3 User Aware Application on Login Record Check the login record for user. All contents copyright (c) 2007 ZyXEL Communications Corporation. 67

68 1.9 How to use Schedule Report How to configure schedule report Vantage Report Support Notes Suppose the company manager wants some regular report about the company network s utilization and the events of threats, now with VRPT s help, the network administrator doesn t need to be upset about the routine burden any more. VRPT server can generate reports on a daily, weekly basis, and also can generate reports for customized period. Please go to Schedule Report>Summary. We can choose Add Daily Report, Add Weekly Report and Add Overtime Report, which is for customized period report. Note: For Overtime Report, the specified time range can t exceed the Stored Log Days in System>General Configuration How to set schedule report template Here comes a scenario. There is a company A that promotes ZyWALL series. This company does not have the ability to develop network management software but he knows VRPT. While company A still wants its customers to believe their network is All contents copyright (c) 2007 ZyXEL Communications Corporation. 68

69 in the charge of himself not the other third part software. Schedule template helps this kind of company to achieve their goal. Please see the magic function. 1. Go to Schedule Report>Template to Add a template. 2. Besides entering customized template name and title, the most import thing is to determine the customized logo. Make sure you have prepared the logo picture before creating template. All contents copyright (c) 2007 ZyXEL Communications Corporation. 69

70 3. To preview the template you can download it and check the details. All contents copyright (c) 2007 ZyXEL Communications Corporation. 70

71 The below picture illustrates the template we created for company A. After creating the template, you can apply it for your customized schedule report. All contents copyright (c) 2007 ZyXEL Communications Corporation. 71

72 1.10 How to use DNS Reverse & Hostname Reverse The way to use DNS Reverse function VRPT 3.1 supports DNS Reverse function to give convenience to user when checking the report. Instead of obscure IP address of web site, VRPT could let you check both the domain name and the IP address of it. It is like a good guider that pulls you out of the sea of the IP address. Please go to System>General Configuration to enable the DNS Reverse function. Please see the sample as following. All contents copyright (c) 2007 ZyXEL Communications Corporation. 72

73 The way to use Hostname Reverse function VRPT 3.1 supplies Hostname Reverse function to give convenience to user when checking the report. It is a useful tool for you to trace the operations of each PC. All contents copyright (c) 2007 ZyXEL Communications Corporation. 73

74 2 Product FAQ 2.1 System Related FAQ Q1: What is Vantage Report (VRPT)? ZyXEL VRPT, a centralized Log & Reporting System, build on Java Technology, for quickly and conveniently collecting or analyzing a distributed network, provides SMB MIS, reseller a simple method of monitoring the associated hardware and activities. ZyXEL VRPT is an application that can collect, analyze logs which distributed by ZyXEL devices, and show user the statistics on web pages or send scheduled reports as to corresponding users. With VRPT, you can monitor network access, enhance security, and anticipate future bandwidth needs. All contents copyright (c) 2007 ZyXEL Communications Corporation. 74

75 Q2: Which operating systems are supported by VRPT 3.1 Server? Windows XP/2000/2003/Vista now. Linux is not available for this version. Q3: What kinds of reports are supported by VRPT? There are two types of logs from devices: Event log and Traffic log. Event logs include many kinds of messages which are related to the events. For example: DoS/DDoS attack, Web Access Block, Network Intrusion Anti-Virus, Anti- Spam and so on. In VRPT, Network Attack report, Event report and Security Policy report are generated by event log information. We could call them event report. The other type of log, traffic log, is for statistic report about traffic passing through the device. Traffic log contains some information like source/destination/protocol/traffic load and so on. Traffic report generated by VRPT is based on the traffic logs information. We could call them traffic report. Q4: Which components are included by VRPT 3.1? VRPT includes a simple Syslog daemon for collecting device log, MySQL database for storing the log for further analysis, an analysis/reporting module to generate report according to user s request and schedule setting, tomcat web server to provide userfriendly interface. Q5: How to install VRPT 3.1 server on the PC? Please refer the hardware/software requirement and quick start guide (QSG) for installation procedure. Installation could be a very simple and straight forward. Just to remind that VRPT installation wizard will install MySQL/Tomcat on your computer. Make sure these applications are NOT running before installation. Q6: How to access VRPT 3.1? After installing VRPT 3.1 server, you could access VRPT by Microsoft IE 6.0 or later, Firefox 1.07 and later and Mozilla and later. Please type Server IP>:8080/vrpt at the remote site if your PC does not install VRPT server or at local host in the URL field if your PC is VRPT server. Default username/password is root/root. NOTE: If user changes Web Server port when installing VRPT, the port 8080 should be changed into customized port when accessing VRPT. Please go to previous part of support note at How to enable customized Web Server port when installing VRPT? All contents copyright (c) 2007 ZyXEL Communications Corporation. 75

76 Make sure the access control rule is configured to allow UDP 514/ TCP 8080 if firewall is running on the VRPT server. Also if user uses customized port when installing VRPT, customized TCP port should be forwarded instead of TCP port Q7: How long will raw data (device logs) be summarized in VRPT database? Under System>General Configuration, you can determine Log store days. VRPT will keep only those logs which are within the configured days value.the default value is 7. Q8: What can I do if I forget the password when logging in VRPT? You may click the Forget Password on the log in web then VRPT will send back your password via . All contents copyright (c) 2007 ZyXEL Communications Corporation. 76

77 Q9: Known Issue for Web Browser Supported by VRPT 3.1. Vantage Report Support Notes The web browser supported by VRPT 3.1 are Microsoft IE 6.0 or later, Firefox 1.07 and later and Mozilla and later. You could not login VRPT 3.1 by multiple Firefoxs or Mozillas on the same machine. That means when you login VRPT as a user you can not open another similar page for other user to login VRPT by using Firefox or Mozillas at the same time on single machine, because Firefox and Mozilla will take them as the same session. And so far print function is not available in Firefox browser although there s a button on web page. Q10: VRPT will be installed as a Window Service by default, is it right? After you install VRPT 3.1 and restart your machine, VRPT will be started up. Under this circumstance it is normal for VRPT 3.1 to start up automatically because we install it as Windows service. Q11: Report Pattern for Schedule Reports. VRPT 3.1 supports two kinds of pattern for Schedule Reports. One is HTML pattern and the other is PDF pattern. HTML pattern report looks like offline VRPT report. The report looks the same style as you could see on live VRPT. It remains the drill down report and the link. Q12: Related General Public License about VRPT. Some components of the Vantage Report distribute with source code covered under one or more third party or open source licenses. We do not include full text of the licenses in this document. If you required them please go to Vantage Report 3.1 User Guide. To get the source code covered under these licenses, please contact CSO team for Vantage Report Technical Support. Q13: The meaning of AC related Registration and Activation with myzyxel.com AC is a short form of Authentication Code. It is generated by the software embedded in VRPT 3.1. AC is a hash code generated from user s PC system. And AC is a useful item for myzyxel.com to do authentication. Only partial of the info is used to create an ID for myzyxel.com authentication. 2.2 Device Related FAQ Q1: Which types of devices are supported by VRPT 3.1? Please refer to Quick Start Guide. All contents copyright (c) 2007 ZyXEL Communications Corporation. 77

78 Q2: How many devices are supported by VRPT 3.1? Vantage Report Support Notes VRPT3.1 can manage 100 units (device) according performance. Q3: How to check traffic logs report on VRPT 3.1 for ZyXEL xdsl products? Unfortunately VRPT 3.1 can t generate such report for ZyXEL xdsl product because such device could not send out traffic log currently. Q4: How can I monitor VPN bandwidth or VPN Usage for ZyXEL xdsl products? Under Monitor>Service>VPN or VPN Usage menu on VRPT 3.1, report is generated by the traffic logs. While ZyXEL xdsl only send event logs for VPN issue. So far it is impossible for you to trace VPN issue for ZyXEL xdsl on VRPT 3.1. Q5: How can I check the Anti-Virus status for ZyXEL xdsl products on VRPT 3.1? Prestige xdsl devices can t send out Anti-Virus event logs so VRPT 3.1 could not generate such report for xdsl Anti-Virus. Q6: How can I check Intrusion/AntiVirus/AntiSpam report for ZyWALL series with f/w 3.63, 3.64 or 3.65? ZyWALL series with f/w 3.62, 3.63, 3.64 and 3.65 do not support such functions so they will not send such event logs to VRPT 3.1. It is normal without those UTM reports available when ZyWALL are using those firmware versions. Q7: What s the brief data flow for VRPT server to generate report? To setup VRPT could be very easy. VRPT will take such steps to get reports. 1. System administrator configures ZyWALL/IDP10/xDSL to send Syslog to VRPT. 2. System administrator starts up VRPT and then do some service registration and activation. Please see VRPT Registration and Activation with myzyxel.com. After that, he/she adds devices in VRPT. Please see Adding Device to Device Tree of VRPT. 3. Syslogs are received and stored in VRPT DB. 4. User queries for report when he/she access VRPT by browser. 5. VRPT server generates the report accordingly. 6. User gets the final report. Below picture shows the brief data flow for VRPT and device. All contents copyright (c) 2007 ZyXEL Communications Corporation. 78

79 NOTE: If device is not added in VRPT, VRPT will ignore the Syslogs from that device. Please make sure the gateway before VRPT server opens UDP port 514 and TCP port If user changes the Web Server port as customized port, she/he should forward such customized port instead of Please select a device from the Device Tree by clicking before querying a report. 3 Trouble Shooting 3.1 Server Related Trouble Shooting What to check if you can not access the GUI of VRPT Server? If the VRPT is behind the NAT/Firewall, please make sure the UDP port 514 is forwarded for the VRPT Server. Also you should forward TCP port 8080 by default. All contents copyright (c) 2007 ZyXEL Communications Corporation. 79

80 If you have customized the Web server port, you should forward such customized TCP port Why can t I start up VRPT 3.1 after installing it? 1. If you want to start up VRPT 3.1, the following content must be included in your machine s system Variables. PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem; Here C means system driver. You could check the system variables by following directory System Properties>Advanced>Environment Variables>System variables on your PC. 2. If the problem still persists after checking item 1, please follow such steps to do so Change log level as the following by editing file <vrpt_home>/vrpt/conf/log4j.properties Change the following lines: log4j.logger.com.zyxel.vantage.vrpt = INFO log4j.logger.com.zyxel.vantage.web = INFO to log4j.logger.com.zyxel.vantage.vrpt = DEBUG log4j.logger.com.zyxel.vantage.web = DEBUG 2.2. Restart your VRPT3.1. And reproduce the problem Send the log files in <vrpt_home>/vrpt/log folder to technical support person Why does VRPT 3.1 shutdown automatically without any reason? 1. Please check the number of devices that are managed by VRPT 3.1. The number of the registered devices should be no more than the license allowed. 2. The AC from your system does not match the one in VRPT database. Please do not do any invalid copy Why does my Web page come back to Login page? 1. Please make sure if your account still in the User List. If Administrator deletes your account, the page will come back to log in page automatically. 2. Session time out. The default time is 15 minutes Is there any way to check if VRPT server has received Syslogs from device? User could go to <vrpt_home>\vrpt\log\logrecord.log to check the current status. Please go to release note for detailed information about it. All contents copyright (c) 2007 ZyXEL Communications Corporation. 80

81 3.1.6 Why VRPT 3.1 can not get any log even when I correctly add device in it? 1. Please make sure the gateway before VRPT server has forwarded UDP Please make sure the connection between VRPT server and device is normal by PING. 3. Please make sure the firewall on VRPT server PC does not block UDP port 514. We take Windows XP for example. You should go to Windows Firewall>Advanced Settings>Services to add a special server for VRPT for such port. 3.2 Device Related Trouble Shooting What could be wrong with Security Policy stay empty also with web action? Please enable content filter service on ZyWALL and activate the log option Forward Web Sites or Blocked Web Sites. LOGS>Log Setting Why are there no new logs received by VRPT 3.1? 1. Please make sure your configuration on device is right. All contents copyright (c) 2007 ZyXEL Communications Corporation. 81